Quick answers
- Is CVE-2026-93426 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-93426 being exploited in the wild.
- How severe is CVE-2026-93426?
- High severity, with a CVSS score of 8.5, published 17 September 2026.
- Which products and versions are affected?
- Signoz 0.87.0 to before 0.142.0.
- Is there a fix for CVE-2026-93426?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-93426 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-93426?
- Check whether you run Signoz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a SQL injection vulnerability in SigNoz's v5 query_range API endpoint. The vulnerability exists because user-supplied telemetry field-key names are not properly escaped before being embedded into ClickHouse SQL queries. Authenticated attackers with Viewer role or higher can exploit this by injecting backticks and quotes into field name parameters to break out of SQL identifier and string literal contexts, allowing execution of arbitrary ClickHouse SQL. The attack requires prior authentication but no additional user interaction. An attacker can read system tables and exfiltrate telemetry data. The vulnerability is fixed in version 0.142.0 and later.
Affected products
- SigNoz SigNoz 0.87.0 to before 0.142.0
Timeline
- 2026-09-17: disclosed